Sandbox Policies — read-only / workspace-write / danger-full-access

Filesystem and network boundaries, declared

The sandbox controls what the agent can do; approval mode controls when it asks first. Three modes: read-only (read files, no writes/commands), workspace-write (read all + write within workspace, no network by default), danger-full-access (no boundaries — sandbox VMs only).

Workspace-write is the default for local work. Codex CAN read anywhere, write inside the workspace, and run shell commands that stay in the workspace. It CANNOT write outside, hit the network, or touch protected paths (~/.ssh, ~/.aws, /etc) without explicit approval. --add-dir grants write access to specific extra directories without abandoning the sandbox model.

OS-level reinforcement: macOS Seatbelt and Linux Landlock provide kernel-enforced isolation in addition to Codex's policy. Even if config is misconfigured, the kernel-level layer blocks escapes. Run codex seatbelt -- npm test or codex landlock -- python -m pytest for the OS-enforced shell wrapper.

Code

Pick the right sandbox per task·bash

# Read-only — analysis without risk
codex --sandbox read-only "explain what this codebase does"

# Workspace-write (default) — normal coding
codex --sandbox workspace-write
# config.toml:
sandbox_mode = "workspace-write"
[sandbox_workspace_write]
network_access = false

# Need an extra writable dir without abandoning sandbox
codex --add-dir /data/shared "regenerate the design tokens"

# Full access — Docker / sandbox VM only
codex --sandbox danger-full-access --ask-for-approval never \
      "fix all eslint errors"

Network allowlist (safer than blanket)·toml

# ~/.codex/config.toml
sandbox_mode = "workspace-write"

[sandbox_workspace_write]
network_access  = true
network_allowlist = [
  "registry.npmjs.org",
  "api.github.com",
  "pypi.org"
]

Sandbox Policies — read-only / workspace-write / danger-full-access

Filesystem and network boundaries, declared

Code

External links

Exercise

Progress

Comments 0